(1) Field of the Invention
The present invention lies in the field of aircraft avionics, and in particular of visual devices for assisting in piloting and navigation.
The present invention relates to a method contributing to making safe a synthetic graphics representation of the view outside an aircraft, and to a synthetic vision device implementing such a method contributing to making it safe.
(2) Description of Related Art
Aircraft avionics provide the pilot and/or the copilot of an aircraft with a large amount of information both about aircraft parameters and flying conditions, and also about navigation. Recent progress in the field of avionics makes it possible in particular to display a synthetic graphics representation of the view outside the aircraft on viewing means, e.g. such as a screen installed in the cockpit of the aircraft or indeed a head-up vision system incorporated in the helmet of the pilot of the aircraft.
Such a synthetic graphics representation of the view outside the aircraft may be in perspective and it is generally constructed on the basis of mathematical functions and software means such as perspective tracing software. The graphics representation is based firstly on at least one database of the environment of the aircraft and secondly on the known position of the aircraft in that environment.
In particular, each database about the environment of the aircraft may include information about the terrain surrounding the aircraft together with the positions in the environment of various particular elements such as obstacles or landing zones, for example. The position of the aircraft may be obtained, among other ways, by means of a satellite locating device fitted to the aircraft.
Furthermore, this synthetic graphics representation may take account of the route of the aircraft, i.e. the direction in which the aircraft is flying, together with its heading, which defines the orientation of the aircraft, e.g. relative to magnetic north, and its attitude, which corresponds to its angles of inclination about roll, pitching, and yaw axes of the aircraft. The synthetic graphics representation is then oriented on the viewing means so as to be consistent with the real view of the aircraft pilot, in compliance with the heading and attitude information about the aircraft.
The roll, pitching, and yaw axes are axes that are characteristic of an aircraft. The roll axis extends in a longitudinal direction from the rear of the aircraft towards the front of the aircraft, the yaw axis extends upwards in an elevation direction perpendicularly to the longitudinal direction, and the pitching axis extends from left to right in a transverse direction that is perpendicular to the longitudinal direction and to the direction in elevation.
This heading and attitude information may for example be provided by a conventional attitude and heading reference system (AHRS).
The synthetic graphics representation of the view outside an aircraft is generally referred to as a synthetic vision system (SVS).
Furthermore, additional piloting information, sometimes referred to as “piloting symbology”, may be superposed on the synthetic graphics representation. This piloting symbology comprises in particular attitude symbology showing attitude references and inclination references such as a horizon line symbol, an attitude scale on either side of the horizon line, and an inclination scale showing the pitching and roll of the aircraft. This attitude information is generally provided by the AHRS type means for determining heading and attitude and it is transcribed graphically on the viewing means with the help of a dedicated display function. The piloting symbology may also include particular marks corresponding for example to the position of landing zones or grounds situated in the environment of the aircraft.
By way of example, Document U.S. Pat. No. 7,352,292 describes a synthetic graphics representation system using a database and information from sensors on board the aircraft. That graphics representation is a combination of data coming from the sensors and information from the database. The database is also updated during flights of the aircraft using data coming from the sensors.
In addition, the display of the synthetic graphics representation and/or of the piloting symbology may be monitored in order to guarantee that the displayed information is valid. Such monitoring may be performed in various ways.
For example, a display may be made safe by a feedback mechanism, i.e. the initial data that generated the display is calculated from the displayed information and the results of the calculation are compared with the initial data.
Document FR 2 670 591 describes such a system for making safe piloting information of an aircraft. That system for making safe performs feedback calculation of navigation parameters on the basis of displayed information and compares the information as obtained in that way with the data coming directly from sensors of the aircraft. An alarm is then issued if a difference is reached that exceeds a predefined threshold. The calculation of the initially displayed information and the feedback calculation of the navigation parameters are both performed by the same function.
It is also possible to use two dissimilar channels for generating graphics in parallel in order to make such a display safe. It is then possible to compare those two graphics representations as generated in parallel, possibly by two distinct calculation means.
Document U.S. Pat. No. 7,342,512 describes a display system for an aircraft having a comparison computer for checking the display. The comparison computer performs calculation independently of the display device on a selection of points actually displayed on the basis of corresponding information supplied by the sensors used by the display device, and it compares the results with the points actually displayed. If a significant difference exists, then an error message is displayed.
In addition, Document U.S. Pat. No. 7,212,175 describes a system comparing information displayed on a viewing screen with data of the aircraft. If the displayed information and the aircraft data are different, then no information is displayed on the viewing screen.
Furthermore, Document EP 1 875 439 describes a graphics generator device having means for monitoring the display of the graphics generator device. The monitor means serve to prevent the use of certain functions that might generate the display of recurrent symbols. Those monitor means also make it possible to generate and monitor images that are dedicated to monitoring and to monitor certain variables of states internal to the graphics generator device.
Document U.S. Pat. No. 8,243,098 describes a device for displaying an authoritative image made up of a plurality of sub-images that are combined with one another. The authoritative image may be compared with an original image in order to validate the original image.
Document FR 2 963 690 describes a mechanism for making safe a client/server computer system serving firstly to prevent fortuitous triggering of a function and secondly to guarantee the integrity of functions and the consistency of information exchanged between the client and the server. That safety mechanism uses computer signatures and the installation of feedback circuits.
Also known is Document U.S. Pat. No. 4,698,785, which describes a method of detecting errors on a display. Information is initially displayed as a function of initial data supplied by a sensor with the data being transformed by a first function, and then “derived” data is calculated on the basis of this displayed information by using a second function, e.g. the inverse of the first function. The “derived” data is then compared with the initial data as supplied by a sensor in order to detect display errors, if any.
Finally, Documents EP 2 169 355 and US 2012/203997 relate to the technological background of the invention.
Furthermore, in the field of aircraft, standards specify safety conditions applicable to the various systems and devices used, e.g. to avionics systems, specifying in particular the effects of a fault on such a system. Five criticality levels for a system known as “design assurance levels” (DAL) are thus defined by the ARP4754A aviation standard and they are used for example in the DO-254 standard.
The DAL A level is the most critical level, where a fault can lead to a problem that is catastrophic and might cause the aircraft to crash. In contrast, the DAL E level is the least critical level, where a fault might give rise to a problem that has no effect on the flying safety of the aircraft.
As a result, avionics systems having the DAL A criticality level are trustworthy and designed to limit the risks of faults appearing. Such systems generally have monitoring and safety devices in order to detect the appearance of faults. Avionics systems having the DAL A criticality level are thus the safest and the most reliable systems of the aircraft.
The display of piloting symbology generally has a DAL A criticality level, since knowledge of the attitude of the aircraft is important or even essential in order to be able to control the flight of the aircraft, and consequently in order to fly in safety. Displaying piloting symbology must thus comply with the requirements for operating safety and integrity needed to allow it to be used as assistance in piloting and in navigating the aircraft.
In contrast, a synthetic graphics representation of the view outside an aircraft does not at present have a DAL A criticality level. In particular, the orientation of the representation in perspective on the viewing means of the aircraft, which involves taking account of the heading and the attitude of the aircraft, is not monitored. Consequently, it is not guaranteed that the representation is properly positioned relative to the heading and the attitude of the aircraft. As a result, this synthetic graphics representation does not satisfy the requirements for operating safety, integrity, and reliability that are necessary for it to be used as assistance in piloting and in navigation.
Thus, the synthetic graphics representation of the view outside an aircraft should be taken into account merely as information made available to the pilot of the aircraft, but without being used for assistance in piloting or in navigation. Such a synthetic graphics representation is nowadays generally compliant with a DAL C criticality level.